Junglewise Threat Intelligence

Alchemy modular-account authentication bypass in old factory functions

Severity: medium · CVSS 4 · Published 2025-07-21

Vendors: npm.

Executive brief

Alchemy's modular smart wallet platform contained an authentication weakness in its legacy wallet creation functions. While wallets already deployed on live networks are safe, new wallets created using the old factory methods could be vulnerable. Alchemy has released patched versions that direct developers to use updated factory functions, preventing future accounts from being exposed.

Technical details

A CWE-287 (Improper Authentication) vulnerability exists in the deprecated account deployment functions within AccountFactory.sol. The vulnerability affects the @account-kit/smart-contracts package versions 4.42.0 through 4.51.0. No network interaction or user authentication bypass is required to exploit the issue during wallet creation; the flaw stems from insufficient security checks in the legacy factory code paths. The attack vector involves creating new accounts through the vulnerable factory methods. The vulnerability is patched in version 4.52.0 and later, with users directed to utilize createSemiModularAccount or createWebAuthnAccount alternatives. Existing deployed wallets are not vulnerable, mitigating widespread impact.

Affected products

  • Alchemy @account-kit/smart-contracts 4.42.0 to 4.51.0

Timeline

  • 2025-07-17: disclosed: Security advisory published on GitHub
  • 2025-07-21: patched: Fix released in version 4.52.0

References

Related threats